Loading story…
A widespread campaign is delivering the Atomic (AMOS) infostealer to macOS users through fake GitHub repositories impersonating popular software. Attackers use SEO to promote these repositories, which instruct users to run terminal commands that install the malware. LastPass and other security teams are actively disrupting the campaign, but new repositories continue to appear.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
Analysis of the fake software sites showed they were distributing Atomic macOS Stealer (AMOS), an infostealer capable of stealing credentials and other sensitive data from infected Macs. Reporting highlighted that the malware could be installed through deceptive download flows that bypass normal user trust expectations.
Security researchers uncovered a campaign using phony GitHub Pages sites impersonating software brands such as LastPass, Malwarebytes, and other password managers to target macOS users. The sites were designed to trick victims into downloading trojanized installers.
6 references tracked. Mallory keeps watching after this page renders.
malwarebytes.com
Open sourcearstechnica.com
Open sourcebleepingcomputer.com
Open sourcebleepingcomputer.com
Open sourcedarkreading.com
Open sourcehelpnetsecurity.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A widespread campaign is targeting macOS users with information-stealing malware via fake GitHub repositories impersonating popular tools. Attackers use SEO poisoning to push malicious sites in search results, leading users to download trojanized applications that deploy the Atomic Stealer malware. The campaign leverages multiple GitHub accounts to evade takedowns and employs social engineering to trick users into executing malicious commands.
Jun 29, 2026
An updated version of **Atomic Stealer** (also known as **AMOS**) was distributed to macOS users through a malvertising campaign that abused Google search ads and impersonated **Slack**. Victims who clicked the ads were redirected through intermediary sites to a fake Slack-themed download page, where macOS users received a malicious DMG carrying the stealer, while Windows users were served a **FakeBat** payload, showing a cross-platform delivery operation. Researchers reported that the malware had been refreshed in late 2023 with added obfuscation designed to conceal strings, payload components, and command-and-control details from defenders. Once launched on macOS, Atomic Stealer prompted victims for their system password and harvested browser data, saved credentials, cookies, cryptocurrency wallet information, and other sensitive files before exfiltrating the data to its operators. Separate analysis of the malware family has documented its focus on stealing high-value user data from Apple systems, while reporting around the campaign also tied the operation to a **malware-as-a-service** model promoted on Telegram, including discounted access offers that highlighted the commercialized nature of the threat.
Aug 15, 2026
Researchers reported multiple campaigns distributing macOS infostealers tied to the **AMOS/AtomicStealer** ecosystem, a malware-as-a-service operation that steals credentials, browser data, cryptocurrency wallets, Apple Notes, files, and **Keychain** material from macOS Catalina and newer systems on Intel, M1, and M2 devices. Earlier reporting on related macOS stealers showed operators relying on social engineering, unsigned DMG files, and password prompts to collect sensitive data, package it into archives, and exfiltrate it to command-and-control servers, with some activity also summarized to Telegram channels. More recent campaigns used **malvertising** and fake software or troubleshooting pages to lure users into running Terminal commands that fetched an AMOS variant known as **"malext"**. Investigators said the malware used obfuscated shell commands, `osascript`, quarantine removal, anti-VM and sandbox checks, and in some cases installed persistence through a LaunchDaemon and helper scripts, while also trojanizing Ledger and Trezor applications and capturing administrator passwords. Reporting also linked AMOS delivery to fake **CleanMyMac** sites and AI-themed lures, indicating operators are rapidly rotating ad accounts and adapting infection vectors to broaden theft and remote access on macOS systems.
Jun 29, 2026